Privacy Policy

1. Information We Collect

We collect the following categories of information when you use the Service:

Account Data

• Your full name and email address.
• Your professional role, for example Senior Associate, Principal Partner, or Trainee.
• The name of your firm, chambers, or organisation, and your location of practice.
• Authentication metadata such as login timestamps and device identifiers.

Professional Data

• Case files, including matter titles, facts, issues, parties, and case notes.
• Incidental information you choose to record, such as strategy notes and witness details.
• Journal entries reflecting your private practice notes and reflections.
• Client financial ledgers, including fees owed, fees collected, and trust account balances.
• Client communication logs, intake records, and contact details.
• Documents and contracts you upload for AI review, drafting, or storage.

Calendar Data

• With your explicit consent through Google's OAuth flow, we access your Google Calendar events to display them in Edgeflow, schedule client meetings, and create deadlines for filings and court appearances.
• We request only the scopes necessary to read and create events. We do not read attachments or unrelated calendars beyond what is required for the feature.

Usage Data

• Technical data such as IP address, browser type, and pages visited within the Service.
• Feature usage data we use to diagnose issues and improve the product.

2. How We Use Your Information

We use the information described above only for legitimate operational purposes, including to:

• Provide and operate the AI tools, including research, contract review, and drafting.
• Maintain your structured case database and client CRM.
• Track financial entries, generate invoices, and report on fees and trust balances.
• Automate client updates, reminders, and scheduled communications you configure.
• Schedule appointments and deadlines through your connected Google Calendar.
• Authenticate users, secure accounts, and prevent fraud or misuse.
• Provide customer support and respond to your requests.
• Comply with applicable laws, court orders, and regulatory obligations.

3. Data Security and Confidentiality

We recognise that legal data is among the most sensitive information any professional handles. We employ industry-standard administrative, technical, and physical safeguards designed to protect case files, client records, financial ledgers, and account data from unauthorised access, disclosure, alteration, or destruction. These safeguards include:

• Encryption of data in transit using TLS.
• Encryption of data at rest in our managed database infrastructure.
• Role-based access controls and the principle of least privilege for our personnel.
• Regular monitoring, logging, and patching of our infrastructure.
• Secure credential handling, with passwords stored using strong hashing algorithms.

No system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly of any suspected unauthorised access.

4. AI Data Processing

When you use AI features, the case data, contract text, prompts, and other information you submit may be transmitted to third-party AI providers (for example, OpenAI or comparable model providers) for the purpose of generating the requested research, draft, summary, or analysis. We select providers that contractually undertake not to use customer inputs to train their public models.

You acknowledge and agree that:

• You should avoid entering unnecessarily sensitive personal client data into AI prompt fields, including full bank account numbers, BVNs, full government identification numbers, or medical records, unless they are strictly necessary for the legal task at hand.
• You remain responsible for ensuring that any disclosure of client information to AI providers through the Service is consistent with your professional duties of confidentiality and any consents you have obtained from your client.
• AI outputs are generated based on statistical patterns and may be inaccurate. They are not legal advice. See the AI Disclaimer in our Terms of Service.

5. Third-Party Services

We rely on carefully selected third-party services to deliver the Service, including the Google Calendar API for calendar integration, AI model providers for AI features, payment processors for subscription billing, and potentially email or WhatsApp gateways for client communication automation. Each provider processes data only to deliver the relevant feature.

We do not sell your personal data, your firm's data, or your clients' data to any third party. We do not share your data with advertisers, data brokers, or marketing networks.

Google API Services User Data Policy

Edgeflow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• For Google sign-in we request only the openid, email, and profile scopes, used solely to create and authenticate your Edgeflow account.
• For calendar integration we request the https://www.googleapis.com/auth/calendar.events scope, used only to display your upcoming events inside Edgeflow and to create hearings, deadlines, and client meetings on your primary calendar at your direction.
• We do not use information received from Google APIs to develop, improve, or train generalised or non-personalised AI or machine learning models.
• We do not transfer this data to third parties except as necessary to provide or improve the Service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• We do not allow humans to read this data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the data is aggregated and used for internal operations in accordance with applicable privacy law.
• You can revoke Edgeflow's access to your Google account at any time from your Google Account permissions page.

6. Data Retention and Deletion

You retain control over the data you store in Edgeflow. You may delete individual case files, client records, journal entries, financial ledger entries, and calendar events at any time from within the Service. Deleted records are removed from your active workspace immediately.

On account cancellation, we will retain your data for a limited grace period of up to thirty (30) days to allow for export or reactivation. After this period, your data will be permanently deleted from our active systems. Residual copies in encrypted backups are purged on our regular backup rotation cycle. We may retain limited records for longer where required to comply with legal, tax, or regulatory obligations.

7. Your Rights

Subject to applicable law, including the Nigeria Data Protection Act, you have the right to access, correct, export, and request deletion of your personal data, to object to or restrict certain processing, and to withdraw consent for optional integrations such as Google Calendar at any time. To exercise these rights, contact us using the details below.

8. Children's Data

The Service is intended for use by adult legal professionals. We do not knowingly collect personal data from individuals under the age of 18. If we learn that we have done so, we will promptly delete that data.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Service, or legal requirements. The "Last updated" date above will always indicate the latest version. Material changes will be communicated through the Service or by email.

10. Contact Information

For privacy questions, data subject requests, or to report a suspected security incident, please contact us at support@edgeflow.legal.